An Introduction to Data Privacy in Practice

About Me

https://katieburak.github.io/torus-talk-2026/

Attribution

This material is adapted from the following sources:

• DSCI 200 - Navigating Data: Acquisition, Exploration and Management, UBC ⭐️
• Data Privacy Handbook
• DSCI 541: Privacy, Ethics, and Security at UBC
• Harvard University Privacy Tools Project: Differential Privacy
• STA 199: Introduction to Data Science and Statistical Thinking, Duke University

What Are You Comfortable Sharing?

Learning Objectives

By the end of today’s lesson, you should be able to:

• Even something as simple as your Facebook “likes” can reveal a lot more than you think…
• Researchers at Cambridge showed that algorithms could predict:
  • Sexual orientation with up to 88% accuracy
  • Race with 95% accuracy
  • Political affiliation with 85% accuracy
• All from analyzing the pages and posts you “liked” (no profile bio or messages needed)!

https://www.cam.ac.uk/research/news/digital-records-could-expose-intimate-details-and-personality-traits-of-millions

What Happens to Your Data?

Every time you use an app, visit a website, click on a link, fill out a survey or even just scroll on your device, your data is being:

Why Does This Matter?

Personally Identifiable Information (PII)

• PII refers to any data that can be used to identify a specific individual.
• Direct identifiers: These clearly and uniquely point to a person.
  • Examples: name, social security number, patient ID
• Indirect identifiers: These don’t identify someone on their own, but could when combined.
  • Examples: age, DOB, postal code, race, sex

Personal Data

Data can be identifiable when:

Scenario: Can This Data Identify You?

A fitness app shares anonymized data with researchers. The dataset includes:

• Step count per day
• General location (postal code)
• Age
• Time of day the user exercises
• Health conditions

Separately, a publicly available dataset includes information from a local running club: names, age groups and 5K race times.

The Mosaic Effect

• The “Mosaic Effect” can happens when separate pieces of data, which alone don’t identify anyone, are combined from different sources to reveal personal information or identify an individual.

• In 2000, 87% of the United States population was found to be identifiable using a combination of their ZIP code, gender and date of birth.

https://dataprivacylab.org/projects/identifiability/paper1.pdf

Pseudonymization and Anonymization

• Pseudonymisation and a nonymisation are techniques to de-identify personal data
• Goal: reduce linkability of data to individuals
• We will now define each of these terms

Pseudonymization

Anonymization

Identifiability Spectrum

• Identifiability is a spectrum
• More de-identified data = closer to anonymized
• Lower identifiability = lower re-identification risk

https://www.kdnuggets.com/2020/08/anonymous-anonymized-data.html

When Are Data Truly anonymous?

• Only if re-identification would require unreasonable effort (factors include cost, time and available technology)
• Data are not anonymous if:

Context Matters

• Whether data are anonymous depends on:
  • The context of the research
  • Available external information
  • Future data uses

De-identification Techniques

Techniques to deidentify your data include:

• Suppression
• Generalization
• Replacement
• Top- and bottom coding
• Adding noise
• Permutation

We will talk about each of these techniques individually.

First, let’s generate some data we can use to help illustrate these concepts.

# A tibble: 4 × 3
  name             age height_cm
  <chr>          <dbl>     <dbl>
1 Joel Miller       52       182
2 Ellie Williams    19       160
3 Tommy Miller      48       185
4 Abby Anderson     28       173

Suppression

Suppression Example

# A tibble: 4 × 2
    age height_cm
  <dbl>     <dbl>
1    52       182
2    19       160
3    48       185
4    28       173

Generalization

Generalization Example

Here we will show an example of generalization on the age column:

# A tibble: 4 × 3
  name           height_cm age_group
  <chr>              <dbl> <chr>    
1 Joel Miller          182 30+      
2 Ellie Williams       160 under 30 
3 Tommy Miller         185 30+      
4 Abby Anderson        173 under 30 

Replacement

Creating Pseudonyms

Replacement with Pseudonyms

# A tibble: 4 × 3
  pseudonym   age height_cm
  <chr>     <dbl>     <dbl>
1 ID1          52       182
2 ID2          19       160
3 ID3          48       185
4 ID4          28       173

Hashing

• Hashing converts names into fixed-length, irreversible strings.
• Unlike pseudonyms, hashed values cannot be easily reversed.
• In R, we can use the digest package (and function) to hash.

# A tibble: 4 × 3
# Rowwise: 
  name_hash                          age height_cm
  <chr>                            <dbl>     <dbl>
1 4a3e0ee26ab3fb1338e893f4d4e7244b    52       182
2 201943dd66d423ed3cce2242a75736d4    19       160
3 81699ec9483bad176eed57ee43ffa010    48       185
4 046dff9ba9cf33573396f4de8c0c0e0b    28       173

• What happens if we juse apply digest to the name vector without using rowwise?

• digest hashed the entire name column as a single object (it’s not vectorized), so mutate recycled the same hash to every row (which is not what we want).

Top- and Bottom-Coding

Top-coding example

• Consider 6ft (182.88cm) is considered our maximum height threshold.

# A tibble: 4 × 3
  name             age height_cm
  <chr>          <dbl>     <dbl>
1 Joel Miller       52      182 
2 Ellie Williams    19      160 
3 Tommy Miller      48      183.
4 Abby Anderson     28      173 

Adding Noise

• Introduces randomness to protect sensitive info
• Examples:
  • Add a small random amount to numeric values
  • Blur images or alter voices
  • Use differential privacy algorithms (advanced)

Adding Noise to Height

This adds random noise to the height variable from a normal distribution (\(\mu=0\), \(\sigma=2\)), reducing exact re-identification risk.

# A tibble: 4 × 3
  name             age height_cm_noisy
  <chr>          <dbl>           <dbl>
1 Joel Miller       52            182.
2 Ellie Williams    19            160.
3 Tommy Miller      48            186.
4 Abby Anderson     28            174.

Permutation

Permutation of Height Values

Here, the height_cm values are shuffled between individuals, preserving the overall distribution but breaking the link between person and value.

# A tibble: 4 × 3
  name             age height_cm_permuted
  <chr>          <dbl>              <dbl>
1 Joel Miller       52                160
2 Ellie Williams    19                173
3 Tommy Miller      48                182
4 Abby Anderson     28                185

Privacy vs. Utility Tradeoff

https://www.researchgate.net/figure/Trade-off-between-privacy-level-and-utility-level-of-data_fig1_357987903

Key Takeaways

• Data exists on a spectrum of identifiability
• Even seemingly anonymous data can often be re-identified (e.g., mosaic effect)
• Different techniques offer varying levels of protection and utility
• Context, external data and technological capabilities all affect re-identification risk
• Responsible data handling requires both technical skill and ethical awareness

Case Study: Brogan Inc. and NIHB Data

• The Non-Insured Health Benefits (NIHB) database contains sensitive health data on First Nations use of services like prescriptions, dental care, and medical devices.
• In 2001, Health Canada began releasing de-identified NIHB pharmacy claims data to Brogan Inc., a private health consulting firm.
• Though personal identifiers were removed, community identifiers remained, and First Nations were not informed until 2007.
• Brogan sold the data to pharmaceutical companies for commercial research and marketing
• Health Canada justified the release by claiming no privacy interests remained since personally identifying information had been removed.

Kukutai, T., & Taylor, J. (2016). Indigenous data sovereignty: Toward an agenda. ANU press.

Discussion

Take 5 minutes to discuss this case in groups of 2-3. Consider these questions to reflect on:

• Was the data truly de-identified?
• Should de-identified data still require community consent before being shared or sold?
• What are the limits of simply removing names and IDs from a dataset?
• How can we measure whether a dataset is truly “safe” to release?

Learning Objectives

By the end of today’s lesson, you should be able to:

• Define identifiers, quasi-identifiers and sensitive attributes in data sets
  
• Explain the limitations of basic deidentification methods
  
• Describe the concepts of \(k\)-anonymity, \(l\)-diversity and \(t\)-closeness
  
• Apply \(k\)-anonymity and \(l\)-diversity to de-identify data
• Understand the basic idea of differential privacy and its significance

Why basic deidentification isn’t always enough

• Last class, we introduced some techniques for deidentification such as suppression and generalization.

• However, individuals can often be re-identified using other information.

• As datasets become more detailed and linkable, privacy risks increase.

• Statistical methods are needed to ensure meaningful deidentification while preserving data utility.

Statistical approaches to deidentification

• \(k\)-anonymity
  
• \(l\)-diversity
  
• \(t\)-closeness
  
• Differential privacy (advanced)

Overview of privacy models

• \(k\)-anonymity, \(l\)-diversity, and \(t\)-closeness are statistical approaches that quantify the level of identifiability within a tabular dataset.
  
• They focus on how variables combined can lead to identification.
  
• These approaches are complementary: a dataset can be simultaneously \(k\)-anonymous, \(l\)-diverse, and \(t\)-close, where \(k\), \(l\), and \(t\) represent numeric thresholds.
• \(k\)-anonymity, \(l\)-diversity, and \(t\)-closeness are typically used to de-identify tabular datasets before sharing.
• They work best on relatively large datasets, where enough observations are present to preserve useful detail while still protecting privacy.

Identifiers, Quasi-Identifiers, and Sensitive Attributes

Privacy models distinguish between three types of variables:

• Identifiers: Direct identifiers such as names, student numbers, email addresses.

• Quasi-Identifiers: Indirect identifiers that can lead to identification when combined with other quasi-identifiers or external data.

  • Examples: age, sex, place of residence, physical characteristics, timestamps, etc.

• Sensitive Attributes: Variables of interest that need protection and cannot be altered as they are key outcomes.

  • Examples: Medical condition, Income, etc.

Importance of Correct Variable Categorization

\(k\)-anonymity

Making a data set \(k\)-anonymous

Choosing \(k\)

• There is no single correct value for \(k\)!
• Higher \(k\) increases privacy, but reduces data detail and utility.
  
• The choice depends on promises made to data subjects and acceptable risk levels.

Example data

• Age and city are quasi-identifiers, and salary is considered a sensitive attribute.

\(k=2\)

\(l\)-diversity

• \(l\)-diversity is an extension of \(k\)-anonymity that ensures sufficient variation in a sensitive attribute.
• This is important because if all individuals within a group share the same sensitive value, there is still a risk of inference.

• Although these data are \(2\)-anonymous, we can still infer that any 30-39 year old from Calgary who participated earns between 90-99k.

\(l\)-diversity

• The approach requires at least \(l\) different values for the sensitive attribute within each combination of quasi-identifiers.
• Again, there is no perfect value for \(l\) (typically \(1< l \leq k\)).

• With \(l=2\), that means that for each combination of Age Range and City, there are at least 2 distinct Salary Ranges.

\(t\)-closeness

There are still issues…

• Even though the data is de-identified, some sensitive patterns can still leak through.

• In the example we discussed, both individuals are grouped into the same age range and city.

• While they are in different salary ranges and exact values are hidden, the range is still quite narrow.

• Due to the similarity of the salary ranges, one can still infer that both individuals earn between $90,000 and $119,999.

Differential privacy

• So, we may need more sophisticated tools to privatize our data…
• Differential privacy is a mathematical approach to protecting privacy
• It ensures algorithm results are nearly the same whether one person’s data is included or not
• Differential privacy makes it hard to tell if any individual’s data is in the dataset, which protects individual’s information (even with unusual or unique data)

• Differential privacy is a complex topic and goes beyond the scope of this course
  
• For a clear and accessible explanation, check out this short video:

iClicker Question 1

Given the data, which field(s) could you generalize to help achieve k = 3 anonymity?

• A. Generalize Age into age ranges (e.g., 20–29, 40–49)
  
• B. Suppress Disease entirely
  
• C. Generalize ZIP Code to first 3 digits (e.g., 130, 148)
  
• D. Generalize Age into age ranges (e.g., 20–29, 40–49) and ZIP code to first 3 digits (e.g., 130, 148)
  
• E. It’s already \(k=3\) anonymous

iClicker Question 2

Which of the following datasets violates \(k = 2\) anonymity?

• A. Only A
  
• B. Only B
  
• C. Only C
  
• D. A and B

Question 3

Consider this 3-anonymous dataset. Is it also 2-diverse with respect to “Condition”?

• A. Yes, both groups have 2 or more different values
  
• B. No, one group violates l-diversity
  
• C. Yes, because the dataset is already k-anonymous
  
• D. No, both groups have only one distinct value

Key Takeaways

• Removing direct identifiers alone does not guarantee privacy
  
• Quasi-identifiers can lead to re-identification if not protected
  
• \(k\)-anonymity makes each record indistinguishable from at least \(k - 1\) others
• \(l\)-diversity improves protection by promoting diversity in sensitive attributes
• Differential privacy offers mathematical privacy guarantees
  
• Choosing privacy parameters involves balancing risk and data utility